CVE-2018-10869CWE-552

redhat-certification does not properly restrict files that can be download through the /download page

High · published July 19, 2018

CVSS v3.0
7.5
EPSS
3%
Percentile
86.0
In the wild
Unconfirmed
What it is

redhat-certification does not properly restrict files that can be download through the /download page. A remote attacker may download any file accessible by the user running httpd.

The record
Technical detail
CVSS v3.0
7.5 · HIGH
Vector
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
CVSS v4.0
Not supplied
EPSS
0.02733 · 86.0th percentile
Weakness
CWE-552 · Files or Directories Accessible to External Parties
Published
2018-07-19T22:00Z
EPSS history
Timeline
  • 19 JUL 22:00Z
    redhat-certification does not properly restrict files that can be download through the /download page
    cvelistv5